* [PATCH 1/1 v2] Added exe field to audit core dump signal log
@ 2013-11-21 2:44 Paul Davies C
2013-11-21 2:48 ` Paul Davies C
2013-11-27 10:56 ` Paul Davies C
0 siblings, 2 replies; 3+ messages in thread
From: Paul Davies C @ 2013-11-21 2:44 UTC (permalink / raw)
To: linux-audit, eparis, rgb
Currently when the coredump signals are logged by the audit system , the
actual path to the executable is not logged. Without details of exe , the
system admin may not have an exact idea on what program failed.
This patch changes the audit_log_task() so that the path to the exe is also
logged.
Signed-off-by: Paul Davies C <pauldaviesc@gmail.com>
---
kernel/auditsc.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 9845cb3..53ecc02 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2353,6 +2353,7 @@ static void audit_log_task(struct audit_buffer *ab)
kuid_t auid, uid;
kgid_t gid;
unsigned int sessionid;
+ struct mm_struct *mm = current->mm;
auid = audit_get_loginuid(current);
sessionid = audit_get_sessionid(current);
@@ -2366,6 +2367,13 @@ static void audit_log_task(struct audit_buffer *ab)
audit_log_task_context(ab);
audit_log_format(ab, " pid=%d comm=", current->pid);
audit_log_untrustedstring(ab, current->comm);
+ if (mm) {
+ down_read(&mm->mmap_sem);
+ if (mm->exe_file)
+ audit_log_d_path(ab, " exe=", &mm->exe_file->f_path);
+ up_read(&mm->mmap_sem);
+ } else
+ audit_log_format(ab, " exe=(null)");
}
static void audit_log_abend(struct audit_buffer *ab, char *reason, long signr)
--
1.7.9.5
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1 v2] Added exe field to audit core dump signal log
2013-11-21 2:44 [PATCH 1/1 v2] Added exe field to audit core dump signal log Paul Davies C
@ 2013-11-21 2:48 ` Paul Davies C
2013-11-27 10:56 ` Paul Davies C
1 sibling, 0 replies; 3+ messages in thread
From: Paul Davies C @ 2013-11-21 2:48 UTC (permalink / raw)
To: linux-audit, eparis, rgb
Resending the patch since I forgot to add the brackets around "null" in v1.
On Thursday 21 November 2013 08:14 AM, Paul Davies C wrote:
> Currently when the coredump signals are logged by the audit system , the
> actual path to the executable is not logged. Without details of exe , the
> system admin may not have an exact idea on what program failed.
>
> This patch changes the audit_log_task() so that the path to the exe is also
> logged.
>
> Signed-off-by: Paul Davies C <pauldaviesc@gmail.com>
> ---
> kernel/auditsc.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 9845cb3..53ecc02 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2353,6 +2353,7 @@ static void audit_log_task(struct audit_buffer *ab)
> kuid_t auid, uid;
> kgid_t gid;
> unsigned int sessionid;
> + struct mm_struct *mm = current->mm;
>
> auid = audit_get_loginuid(current);
> sessionid = audit_get_sessionid(current);
> @@ -2366,6 +2367,13 @@ static void audit_log_task(struct audit_buffer *ab)
> audit_log_task_context(ab);
> audit_log_format(ab, " pid=%d comm=", current->pid);
> audit_log_untrustedstring(ab, current->comm);
> + if (mm) {
> + down_read(&mm->mmap_sem);
> + if (mm->exe_file)
> + audit_log_d_path(ab, " exe=", &mm->exe_file->f_path);
> + up_read(&mm->mmap_sem);
> + } else
> + audit_log_format(ab, " exe=(null)");
> }
>
> static void audit_log_abend(struct audit_buffer *ab, char *reason, long signr)
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1 v2] Added exe field to audit core dump signal log
2013-11-21 2:44 [PATCH 1/1 v2] Added exe field to audit core dump signal log Paul Davies C
2013-11-21 2:48 ` Paul Davies C
@ 2013-11-27 10:56 ` Paul Davies C
1 sibling, 0 replies; 3+ messages in thread
From: Paul Davies C @ 2013-11-27 10:56 UTC (permalink / raw)
To: linux-audit, eparis, rgb
Ping......
On Thursday 21 November 2013 08:14 AM, Paul Davies C wrote:
> Currently when the coredump signals are logged by the audit system , the
> actual path to the executable is not logged. Without details of exe , the
> system admin may not have an exact idea on what program failed.
>
> This patch changes the audit_log_task() so that the path to the exe is also
> logged.
>
> Signed-off-by: Paul Davies C <pauldaviesc@gmail.com>
> ---
> kernel/auditsc.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 9845cb3..53ecc02 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2353,6 +2353,7 @@ static void audit_log_task(struct audit_buffer *ab)
> kuid_t auid, uid;
> kgid_t gid;
> unsigned int sessionid;
> + struct mm_struct *mm = current->mm;
>
> auid = audit_get_loginuid(current);
> sessionid = audit_get_sessionid(current);
> @@ -2366,6 +2367,13 @@ static void audit_log_task(struct audit_buffer *ab)
> audit_log_task_context(ab);
> audit_log_format(ab, " pid=%d comm=", current->pid);
> audit_log_untrustedstring(ab, current->comm);
> + if (mm) {
> + down_read(&mm->mmap_sem);
> + if (mm->exe_file)
> + audit_log_d_path(ab, " exe=", &mm->exe_file->f_path);
> + up_read(&mm->mmap_sem);
> + } else
> + audit_log_format(ab, " exe=(null)");
> }
>
> static void audit_log_abend(struct audit_buffer *ab, char *reason, long signr)
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-11-27 10:56 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-11-21 2:44 [PATCH 1/1 v2] Added exe field to audit core dump signal log Paul Davies C
2013-11-21 2:48 ` Paul Davies C
2013-11-27 10:56 ` Paul Davies C
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox